WAF

AWS WAF is a cloud-native web application firewall. It serves as the first line of defence for attacks against Internet-facing resources, operating at OSI model layer 7 to block requests that match one of its rules (e.g. that appear to be attempts at SQL injection or XSS, based on IP address, request rate, geographic location or request headers and body content).

Concepts

• Web ACLs are sets of rules, defined by rule statements.
  • The DefaultAction determines how requests not matching any rules are treated.
  • Rules comprise statements defining inspection criteria and an action to take if matched (blocked, challenged with a CAPTCHA, counted, or allowed through. Rules can be based on:
    • IP sets, sets of IP addresses.
    • Regex sets, sets of regular expression patterns.
    • Rule groups, sets of shared rules.
• Rule groups allow defining reusable sets of rules, made available via Managed Rules or the Marketplace.
• WCUs are measure of compute resources required to run rules, rule groups, and web ACLs.

Observability

• Request sampling?
• Logs can be sent to Data Firehose
• Metrics can be sent to Metrics

WAF Classic

WAF Classic is missing several newly introduced features:

• AWS Managed Rules which provide preprepared rules for common threats.
• Simpler quotas and higher limits on rule size.
• Billing based on compute requirements for rule execution, measured in WCU.
• Document-based API rather than per-rule API requests.
• Combined waf and waf-regional APIs into a single wafv2 API.

An automated migration path is provided via CloudFormation.

Rules

• AWS Managed Rules are grouped into three broad categories:
  • Baseline provide good coverage of common threats.
  • Use-case specific protect specific operating systems or applications.
  • IP Reputation Lists based on threat intelligence.

Limits

• WCU limits are enforced at configuration-time:
  • Each rule is assigned a capacity when created or updated.
  • Each rule group is assigned an immutable capacity at creation-time. Any changes must remain within the rule group's capacity.
  • The maximum capacity of a web ACL is 1,500. This may be raised with a support request.
• Web ACLs can be assigned to ALBs only within regions; e.g. not to Outposts.
• Only one web ACL can be assigned to each AWS resource: it's a one-to-many relationship.
• A web ACL can be associated with one or more CloudFront distributions, but a web ACL associated with a CloudFront distribution cannot be associated with any other AWS resources.

WCU costs

References

• Protecting Your Web Application Using AWS Managed Rules for AWS WAF